           status => 200
           (slurp body) => (contains "access_token"))))
 
+(fact "Client may receive its token in Implict Grant scenario."
+      (u/purge-users)
+
+      ;; given
+      (u/create-user {:login "nioh" :enabled true} "alamakota")
+
+      ;; when
+      (let [state (-> (session (wrap-defaults oauth-routes api-defaults))
+                      (header "Accept" "text/html")
+                      (request (str "/authorize?response_type=token"
+                                    "&client_id=" (:id client)
+                                    "&scope=" scope
+                                    "&state=" state
+                                    "&redirect_uri=" redirect-uri))
+
+                      ;; login window
+                      (follow-redirect)
+                      (request-secured "/login"
+                                       :request-method :post
+                                       :params {:username "nioh"
+                                                :password "alamakota"})
+
+                      ;; response with token
+                      (follow-redirect))]
+
+        ;; then
+        (get-in state [:response :status]) => 302
+        (get-in state [:response :headers "Location"]) => (contains "access_token")))
+
 (fact "Client may receive its token in Resource Owner Password Credentials Grant scenario."
       (u/purge-users)
 

        (get-in state [:response :status]) => 302
        (get-in state [:response :headers "Location"]) => (get-in app-config [:cerber :landing-url])))

(fact "Wrong credentials redirect again to login page with failure info displayed."
      (u/purge-users)

      ;; given


(defonce client (c/create-client "http://foo.com" [redirect-uri] [scope]  nil ["moderator"] false))

(fact "Enabled user with valid password is redirected to langing page when successfully logged in."
      (u/purge-users)

      ;; given
